ARP

Arp packet types

This nomenclature comes from RFC 3927.

• ARP Announcement -- Source and destination network address are equal. Destination hardware address is all zeros. Source hardware address is the sending station's MAC.
• ARP Probe -- Source network address is all zeroes, as is destination hardware address. Source hardware address is the sending station's MAC. Destination network address is the address being probed.
  • Used for LLMNR in zero-configuration networking

Linux ARP states

These are encoded in the ndm_state bitmask of a RTM_NEWNEIGH/RTM_GETNEIGH netlink message (valid ndm_flags values include NTF_PROXY for proxy ARP entries and NTF_ROUTER for IPv6 routers).

state	meaning	transitions
permanent	never undergoes verification or expiry	none (manually configured)
noarp	normal expiration, never verified "A device with no destination cache"	use resets use counter
reachable	normal expiration	use resets timer
stale	still usable, needs verification	use resets timer and returns to reachable timer changes state to delay
delay	schedule ARP request, needs verification	use resets timer and returns to reachable timer changes state to probe, issuing ARP request
probe	need ARP reply for verification (reprobing)	use resets timer and returns to reachable timer reissues ARP requests or moves to failed
incomplete (new entry)	need ARP reply for first use	use resets timer and returns to reachable timer reissues ARP requests or moves to failed
failed	no response received / invalid cache entry	timer governs reissuing of ARP requests use resets timer and moves to reachable

See Also

• Linux's rtnetlink(7) man page
• "The ARP State Machine" James Westall's CpSc 853 "Protocol Implementation" class notes
• "2.1 Address Resolution Protocol (ARP)" Martin Brown's "Guide to IP Layer Network Administration with Linux"